Hi Jen,
I was all set to answer you here this afternoon and wouldn't ya know, swamped with phone calls and thousands of bounced e-mails..*wry grin.
So, you now have the directions to get full header info...the only thing left for me to offer is blocking.
I'm so disgusted with these viruses that I've started blocking them with the routing table. I tried just denying their email but the poor server still has to talk to them long enough to deny.
Send me the headers once you uncover them. Copy/paste them in new e-mails so that I can see them clearly and from this I can determine the IP of origin. That is what I'll block. I've wasted many hours trying to track down the actual identity of these machines/owners. I figure now that if it's someone with more than a coincidental e-mail address in their files somewhere, they'll call me when they find that they can't get to a website on this server. Then I'll know who they are..*grin...or better yet, they'll call you...*big grin
I've been blocking quite a few lately and haven't heard any "screams" yet. I'm in blocking mode...send all ya want.
see ya,